Transparent client authentication

ABSTRACT

A system and method for authenticating an application (client) to a server or service. During a registration phase, an application that requests access to a service can receive a service identifier, which it can authenticate. The application can generate and send to the server or service an application-service key that is based upon the authenticated service identifier and a secret application key; a service-application identifier that can be based upon the authenticated service identifier and an application identifier; and a registration nonce, all of which can be stored at the server. During the authentication phase, the client can send to the server the application-service identifier, which the server can use to lookup the stored registration data. The server can send the registration nonce to the client, which can compute a proof of possession of the service-application key and send to the server. The server can compute its own version of this key and compare it to the received key. If they correspond, then the client is authenticated.

RELATED APPLICATIONS

This application claims priority to U.S. Application No. 61/105,962,filed Oct. 16, 2008, the disclosure of which is incorporated byreference in its entirety for all purposes.

BACKGROUND OF THE INVENTION

Internet crime, such as the practice of stealing authenticationcredentials through phishing, demonstrates the need for more effectiveand usable Internet authentication technology. Phishing can operate bypresenting the user with a web page that appears to be a duplicate of,or associated with, a site to which the user provides its authenticationcredentials, such as a username and password. When the user provides itscredentials to the phishing site, the credentials can be intercepted bythe site operators and illicitly used on the real site to stealproperty, maliciously alter the user's account information, etc.

Although usernames and passwords don't require any special equipment touse, they are prone to being forgotten, written down in an unsecure way,stolen and guessed. While client-based cryptographic protocols such asHTTP Digest Authentication allow a proof of knowledge of the password tobe substituted for the password itself, they only provide protectionagainst phishing when used as the exclusive means of communicating thepassword value and suffer from some of the other disadvantages ofpasswords.

Some banks have deployed mechanisms that require additionalauthentication factors from a customer when the customer attempts toaccess its account from a new machine, i.e., a machine from which theuser has not previously (or recently) attempted to access its account.While such systems can reduce fraud, they can impose burdensomerequirements on users to log in. Customers who use a site infrequentlyoften find that they are required to re-authenticate using theiradditional authentication factors almost every time they log in.Further, the additional factors may be easy to forget.

Blogs and other Web sites that provide access to user-generated contentneed lightweight authentication technologies that allow a reader to beauthenticated to post a comment with as little extraneous interaction aspossible. In such systems it is frequently sufficient to know that theentity seeking to post a new comment is the same entity that visited thesite at an earlier time.

The HTTP ‘cookie’ mechanism can be used to provide a lightweight meansof re-authenticating a client. But cookies are not designed for thisparticular purpose and typically lack the cryptographic securitycontrols needed for reliable authentication. For example, plaintextcookie information is passed to the server rather than a proof ofpossession of the cookie information. Further, the cookie must be storedon the client as plaintext, which allows a ‘cookie stealing’ attack.Finally, cookies are used for many different purposes and clients aregenerally unable to distinguish cookies that support an authenticationfunction from other types of cookies. Consequently, it is oftenimpractical for a client to manage the expiry of authentication cookiesseparately from those used for other purposes. Expired authenticationcookies could make it difficult for users to interact with sites thatrely on cookie-based authentication.

SSL Client Authentication is a robust protocol that employs Public KeyCryptography (PKI) and X.509v3 client certificates. Despite the name,SSL Client Authentication is actually designed to authenticate the userof the browser rather than the browser (i.e., a client application)itself. Despite the advantages and widespread deployment of thisprotocol, it has not been widely used. This is because the SSL ClientAuthentication user interface can be difficult to use, particularly ifthe user has multiple client certificates. Also, it can be difficult tovalidate and provision a certificate to each end user.

What is needed is a client application authentication protocol thatrequires little or no user interaction and is very easy to use, requiresthe client to maintain little or no state information and that does notburden the server with the need to maintain much state information.

SUMMARY OF THE INVENTION

The present invention relates generally to authentication and inparticular to a lightweight authentication protocol for easilyre-authenticating an application.

A service identifier can be sent from a server to an application at aclient. The server can receive an application-service identifier that isbased upon the service identifier and an application identifier. Theserver can also receive from the application an application-service keythat is based upon the server identifier and a secret application key atthe client. The server can store the application-service identifier andthe application-service key. When the application later communicateswith the server for re-authentication, the server can send to theapplication the service identifier. The server can receive theapplication-service identifier that is based upon the service identifierand an application identifier. The server can send to the application aserver nonce and receive from the application a proof of possession ofthe secret application key based upon the application-service identifierand the application-service key. The server can compute an expectedvalue of the proof of possession and compare it with the proof ofpossession received from the application. If the expected proof ofpossession corresponds to the received proof of possession, then theserver can determine that the application is authentic.

These and other embodiments of the invention are described in moredetail in conjunction with the text below and attached figures.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a system in accordance with an embodiment of the presentinvention.

FIG. 2 shows a registration message flow in accordance with anembodiment of the present invention.

FIG. 3 shows an authentication message flow in accordance with anembodiment of the present invention.

FIG. 4 shows a message flow diagram for registrar-only authenticationand authorization in accordance with an embodiment of the presentinvention.

FIG. 5 shows a message flow diagram for authentication/authorizationfactor override in accordance with an embodiment of the presentinvention.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

In accordance with an embodiment of the present invention, a usercomputer running an application (also known as a “client”) that haspreviously authenticated to a server can easily be re-authenticated.

A system in accordance with an embodiment of the present invention isshown in FIG. 1. A server 101 provides various services S1, S2, S3,etc., to applications (also, “clients”) C1 and C2 at Computer A 102 andC3 at Computer B 103. A client such as C1 can register for easyre-authentication in accordance with embodiments of the presentinvention to use a service such as S3 at server 101.

Server 101 can include one or more processors coupled to memory. Theprocessors can include a general purpose microprocessor such as thePentium processor manufactured by the Intel Corporation of Santa Clara,Calif.; an Application Specific Integrated Circuit that embodies atleast part of the method in accordance with an embodiment of the presentinvention in its hardware and firmware; a combination thereof; etc.Memory can be any device capable of storing electronic information, suchas RAM, flash memory, a hard disk, an internal or external database,etc. Memory can store instructions adapted to be executed by processorto perform at least part of the method in accordance with the presentinvention. Memory can also store data such as identifiers andcryptographic key material. Memory can be tamper resistant to helpprevent the unauthorized disclosure or modification of sensitiveinformation. Memory can also store instructions adapted to be executedby the processor to provide services such as S1, S2 and S3 as shown inFIG. 1.

Computers A 102 and B can each include one or more processors coupled tomemory. The processors can include a general purpose microprocessor suchas the Pentium processor manufactured by the Intel Corporation of SantaClara, Calif.; an Application Specific Integrated Circuit that embodiesat least part of the method in accordance with an embodiment of thepresent invention in its hardware and firmware; a combination thereof;etc. Memory can be any device capable of storing electronic information,such as RAM, flash memory, a hard disk, an internal or externaldatabase, etc. Memory can store instructions adapted to be executed byprocessor to perform at least part of the method in accordance with thepresent invention. Memory can also store data such as identifiers andcryptographic key material. Memory can be tamper resistant to helpprevent the unauthorized disclosure or modification of sensitiveinformation. Memory can also store instructions adapted to be executedby the processor to run applications such as C1, C2 and C3 as shown inFIG. 1.

Each service S1, S2 and S3 can be associated with its own respectiveservice identifier IS1, IS2 and IS3. These service identifiers can bestored in memory accessible to the server processor. Each applicationC1, C2 and C3 can be associated with its own respective applicationidentifier IC1, IC2 and IC3. These application identifiers can be storedin memory accessible to the client processor.

Embodiments of the present invention can include a registration phaseand an authentication phase. Both phases can be performed as a layeredextension to a security protocol that provides server authentication andestablishes a cryptographically secure shared secret (Kt) that can beused to establish an encrypted, integrity-checked (secure) channelbetween the client and the server, such as SSL, TLS, etc.

FIG. 2 shows a registration message flow in accordance with anembodiment of the present invention. A master secret key Kc and a masteridentifier Ic can be generated for or by an application at a client,e.g., during installation of the application, the first time theapplication is used by a user, etc. The master secret key can besufficiently large to provide protection against a cryptanalytic attackand can be stored in tamper-resistant, protected memory to protect itfrom being stolen or improperly changed.

Each service at a server that supports client authentication inaccordance with embodiments of the present invention can be issued aunique service identifier, Is. This identifier can be shared amongmultiple servers, e.g., managed by the same party.

During registration, the service identifier Is can be sent to theclient. For example, the option to register for the re-authenticationprotocol and/or service identifier Is can be included as extensions to aX.509 certificate used to authenticate the server's public key.Alternatively, Is can be communicated in any other suitable way to theclient. For example, over the secure channel, the client can send to theserver a message requesting registration to a service. The server cansend back to the client a message rejecting the request, or acceptingthe request. The message accepting the request can include serviceidentifier Is.

The client can combine Is with an application identifier Ic to form anapplication-service identifier Ics that can uniquely correspond to theapplication-service pair. For example, the service identifier can beconcatenated with the application identifier and then hashed or MACed toform an application-service identifier. That is,Ics=MAC(Is,Ic)

Examples of a Message Authentication Code (“MAC”, a key-dependent hash)include HMAC, UMAC, CMAC, Poly1305 AES, etc. A message digest (i.e., anon-key dependent hash) may be used instead of a MAC in accordance withcertain embodiments of the present invention. Examples of a messagedigest include MD5, SHA-1, SHA-2, etc. The client can also generate anapplication-service key Kcs based upon the master key Kc and otherelements, such as the service identifier and a random nonce generated bythe client (Rc), known as the registration nonce. Thus, for example,Kcs=MAC(Is+Rc,Kc)

Ics, Kcs and Rc can be sent to the server, which can store (“register”)them in a database or other repository that can be used to track theclient's access to the service.

FIG. 3 shows an authentication message flow in accordance with anembodiment of the present invention. When the client requests access tothe service after completion of the registration phase, the server canuse the information generated and stored during registration to easilyauthenticate the client. The client can obtain and authenticate theservice identifier Is and then generate Ics, which can be based upon Isand Ic. For example, the client can generateIcs=MAC(Is,Ic)

Ics can be sent from the client to the server. The server can use Ics tolookup the registration nonce, Rc, used for the registration of theclient to the particular service. The server can send Rc to the client.

The client can generate a proof of possession of Kcs based upon Ics, Rcand Kcs and send it to the server. For example, the client can generateproof of possession P, such thatP=MAC(Ics+Rc,Kcs)

The server can generate its own version of P based upon the values ofIcs, Rc and Kcs that were stored during the registration phase. It canthen compare its own version of P with the version of P received fromthe client. If they correspond, then the client has been successfullyauthenticated. If not, the client has not been successfullyauthenticated.

Additional can be introduced into the protocol to preventman-in-the-middle attacks. For example, the server can generate and senda random nonce value, ns, when it sends Rc to the client. Likewise, theclient can generate an send a random nonce value, nc, when it sends P tothe server. These nonces can be used in generating the proof ofpossession. For example,P=MAC(Ics+Rc+ns+nc,Kcs)

Nonces may be used as appropriate in accordance with embodiments of thepresent invention as would be understood by those of skill in the art.

A registration system in accordance with an embodiment of the presentinvention is shown in FIG. 4. Parameter Generator 401 generates aservice identifier, Is, for each service and is coupled toCommunications Module 402, which can send the service identifier Is to arecipient. Communications Module 402 can also receive anapplication-service identifier, Ics, that is based upon the serviceidentifier Is and an application identifier Ic and sends it toCredential Management Module 403, which can cause it to be store it inMemory 404. Communications Module 402 can also receive anapplication-service key Kcs that can be based upon the serviceidentifier Is and a secret application key Kc and can cause it to bestored in Memory 404 such that Kcs is correlated with Ics.

An authentication system in accordance with an embodiment of the presentinvention is shown in FIG. 5. Communications Module 501 can send aservice identifier Is to a recipient, and receive an application-serviceidentifier Ics based upon the service identifier Is and an applicationidentifier Ic. Communications Module 501 can also receive a proof ofpossession P of the secret application key Kc based upon theapplication-service identifier Ics and the application-service key Kcs.Communications Module 501 can send the application-service identifierIcs and the received proof of possession P to the Authentication Module502, which can be in communication with Lookup Module 503. Lookup Module503 can retrieve from Memory 504 the application service key Kcs that iscorrelated with Ics and send Kcs to Authentication Module 502.Authentication Module 502 can compute an expected value of the proof ofpossession P′ of the secret application key based upon theapplication-service identifier Ics and the application service key Kcs.Authentication Module 502 can compare the expected proof of possessionP′ with the received proof of possession P. If they correspond, then theapplication is determined to be authentic. If not, the authentication isdeemed to have failed.

Other embodiments of the present invention can make use of variationsthat would be understood to those of skill in the art. For example, inthe registration system shown in FIG. 4, Communications module 402 canreceive a registration nonce Rc from an application and send it toCredential Management module 403, which can cause it to be stored inMemory 404 correlated with Ics and Kcs.

Likewise, Authentication Module 502 can generate a different servernonce ns for use in each communication sent from Communications Module501 to an application.

Embodiments of the present invention can be implemented in any suitabledevice, such as a cell phone, a personal computer, a token, a RFID, asmart card, an embedded device, etc. An embedded devices usuallyincludes a computer system adapted to perform one or a few dedicatedfunctions and that is embedded as part of a complete device, which caninclude both electrical and mechanical components. Embedded devices canbe used in factory control equipment, light switches, appliances,watches, etc. For example, embodiments of the present invention can beused to ensure that information obtained from, and instructions sent to,industrial control equipment are from and to authenticated sources. Thiscan be implemented by embedding a processor and memory storinginstructions adapted to be executed by the processor to perform at leastsome of the steps of the present invention in an industrial machine. Theembedded device can be used to authenticate the machine to a controller.Embedded devices in accordance with embodiments of the present inventioncan also be implemented in telecommunications switches, cell phones,routers, computer game consoles, digital cameras, DVD players, avionics,motors, control systems, medical systems, etc.

It is understood that the examples and embodiments described herein arefor illustrative purposes only and that various modifications or changesin light thereof will be suggested to persons skilled in the art and areto be included within the spirit and purview of this application andscope of the appended claims.

1. A method for re-authenticating a previously-registered application for later re-authentication, comprising: sending from a server to the application a service identifier; receiving at the server an application-service identifier based upon the service identifier and an application identifier; sending to the application a registration nonce received at the server from the application during registration; receiving from the application proof of possession of a secret application key based upon the application-service identifier, the registration nonce, and an application-service key; computing an expected value of the proof of possession of the secret application key and comparing the computed expected value with the received proof of possession of the secret application key; and if the expected proof of possession of the secret application key corresponds to the received proof of possession of the secret application key, then determining that the application is authentic.
 2. The method of claim 1, further comprising receiving, by the server, an application nonce, wherein the proof of possession of the secret application key is further based upon the application nonce.
 3. The method of claim 2, wherein the proof of possession of the secret application key comprises a message authentication code generated from the application nonce, the registration nonce, the application-service identifier, and the application-service key.
 4. The method of claim 1, wherein the application-service key is based upon the registration nonce, the service identifier, and the secret application key.
 5. The method of claim 1, wherein the application is installed on a computer.
 6. The method of claim 1, wherein the application is an executing application.
 7. A system for re-authenticating a previously-registered application for later re-authentication, comprising: a communications module in communication with an application for sending to the application a service identifier; receiving from the application an application-service identifier that is based upon the service identifier, a registration nonce, and an application identifier; and receiving from the application a proof of possession of the secret application key based upon the application-service identifier, the registration nonce, and an application-service key; a lookup module; a memory in communication with the lookup module, the memory storing the application-service identifier, the registration nonce, and the application-service key; and an authentication module in communication with the communications module and the lookup module, the authentication module: computing an expected value of the proof of possession of the secret application key based upon the application-service identifier, the registration nonce, and the application-service key received from the lookup module; and comparing the computed expected value with the received proof of possession of the secret application key to determine if the application is authentic.
 8. The system of claim 7, wherein the application-service identifier is a message authentication code generated from the application identifier and the service identifier.
 9. The system of claim 7, wherein the application-service identifier is a message digest.
 10. The system of claim 7, wherein the application-service key is a message authentication code generated from the service identifier, the registration nonce, and the secret application key.
 11. The system of claim 7, wherein the application-service key is further based upon the registration nonce.
 12. The system of claim 7, wherein the application-service key is a message authentication code generated from the service identifier, the secret application key, and the registration nonce.
 13. The system of claim 7, wherein the application is installed on a computer.
 14. The system of claim 7, wherein the application is an executing application.
 15. The system of claim 7, wherein the communications module, the lookup module, the memory, and the authentication module are implemented in an embedded system.
 16. The system of claim 7, wherein the communications module receives an application nonce and wherein the proof of possession of the secret application key is further based upon the application nonce.
 17. The system of claim 7, wherein: the lookup module looks up the registration nonce received at the server from the application during registration and the communications module sends the registration nonce to the application, the proof of possession of the secret application key is further based upon the registration nonce.
 18. The system of claim 16, wherein the proof of possession of the secret application key is a message authentication code generated from the application nonce, the application-service identifier, the registration nonce, and the application-service key.
 19. The system of claim 7, wherein the application-service key is based upon the registration nonce, the service identifier and the secret application key. 